        map->AuthorizationServer
        (<- (component/using
             [:access-token-store
-             :session-store
+             :browser-session
              :user-domain
              :client-registry
              :authenticator]))))

           ;; (Can we do this in a go block however?)

           (debugf "OAuth2 authorization server: Authorizing request")

           (let [session (get-session-from-cookie req SESSION-ID (:session-store component))
                 {response-type "response_type" client-id "client_id"} (:query-params req)
                 r-t (or response-type (:response-type session))
                 ]
             (case r-t
               "code" (authorize-client
                       session
                       component req store)

               ;; Unknown response_type
               {:status 400
                :body (format "Bad response_type parameter: '%s'" response-type)}
               )
             ))
         wrap-params
         wrap-schema-validation)


      ;; TODO I'm worred about the fact we must ensure that the session
      ;; represents a true authenticated user
      (fn [req]
        (let [session (get-data (:browser-session component) req)]
          (if (:cylon/authenticated? session)
            (let [permitted-scopes (set (map
                                         (fn [x] (apply keyword (str/split x #"/")))
